Production fluid pipelines from wells are generally thin-walled in order to minimise the cost of the pipeline. Thus it is essential that they are protected against excessive pressure that might rupture the pipe, which would be very expensive to replace and cause environmental pollution. A conventional system used to protect pipelines from over-pressure is the high integrity pipeline protection system (HIPPS). Conventionally this is an electro-hydraulic system, employing pressure sensors to measure the pressure in the pipes which are used, through the electronics of a control module, to control the closure of a production pipe HIPPS valve. This retains the high pressure within a short section of pipeline between the production “tree” and the HIPPS valve which is capable of withstanding the pressure. This prevents the main, thinner-walled section of pipe from being exposed to pressure which may exceed the pressure rating.
A prior art HIPPS system for a sub-sea hydrocarbon extraction well is shown schematically in FIG. 1. The comparatively thin-walled production pipeline 1, which in the case of a sub-sea well may be several kilometres long, is connected to a thick-walled production pipeline 2 feeding production fluid from a well tree. The two pipelines are connected via a hydraulically actuated valve comprising HIPPS valve 3 and hydraulic actuator 4. During normal operation, the HIPPS valve 3 is held in an open state by the failsafe hydraulic actuator 4, which is fed with pressurised hydraulic fluid via a directional control valve (DCV) 5 located within a sub-sea control module (SCM) 6 from a hydraulic power unit (HPU) 7 typically located on the sea surface via an umbilical 8. The HPU 7 generally supplies pressurised hydraulic fluid for a multiplicity of hydraulically operated functions on the well. The pressure of the fluid within the pipelines 1 and 2 are measured by pressure sensors 9 and 10 respectively. These sensors are connected to an electronic unit 11 within which a pressure threshold is set, the output of which feeds the DCV 5. When the pressure in the pipeline 2 exceeds the set threshold, the electronics unit 11 operates the DCV 5, thus shutting off the hydraulic feed to actuator 4 and venting from the DCV the hydraulic pressure in the actuator 4. This allows the failsafe mechanism, typically a spring, to close the HIPPS valve 3, thus protecting the pipeline 1. Opening of the HIPPS valve 3 to resume fluid production is then only effected when the output fluid pressure from the well has been controlled, typically by a choke, to reduce the pressure to a safe level.
The conventional HIPPS system shown suffers from the drawback that it relies on electronic pressure sensors. These have been known to fail, which could result in a loss of the HIPPS system, putting the pipeline at risk of damage.